0fe6c77ff048ea00556bc134fec64922

Sharing

Copy URL

Twitter E-mail

General

Target

0fe6c77ff048ea00556bc134fec64922
Size

528KB
MD5

0fe6c77ff048ea00556bc134fec64922
SHA1

8c3f67d5690972af67767280275b0a77672e7ef7
SHA256

213c5a44d670444ce221cfd2ea5af858b98dfae93196babee0640a687155e128
SHA512

ea71a3539edc55e5955ea414dcd0469a6b11ed00d8c97f1e7b8dc9867a2343c34b4b4db97abe04a4a554fe0036bd4df1bd58877c2d73eb9faaf61d306e3d5444
SSDEEP

12288:vk73FAXZG5KuVWxCqKwYHjdy9/VtiVh7J5r:M7VAXZGouYx1KwYDdG/iVh7J5r

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0fe6c77ff048ea00556bc134fec64922

Files

0fe6c77ff048ea00556bc134fec64922
.exe windows:4 windows x86 arch:x86

c85230c1c6d52bc01f0017e60b32dbf7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
_XcptFilter
_exit
_onexit
__dllonexit
?terminate@@YAXXZ
_except_handler3
??1type_info@@UAE@XZ
wcscpy
fgets
__CxxFrameHandler
_setjmp3
_endthreadex
_beginthreadex
printf
sscanf
sprintf
_errno
strerror
perror
__mb_cur_max
_isctype
_pctype
calloc
fprintf
_iob
fflush
free
malloc
memcmp
fwrite
fseek
ftell
fread
fputc
wcscat
__p__commode
fclose
_ftol
rand
srand
exit
strncat
strncmp
atof
memcpy
strchr
strcat
strtok
strcmp
strcpy
system
atoi
time
gmtime
_CxxThrowException
??0exception@@QAE@ABV0@@Z
_vsnprintf
strlen
strncpy
memset
strstr
??2@YAPAXI@Z
??3@YAXPAX@Z
_purecall
_EH_prolog
_stat
_fileno
signal
fputs
getenv
_setmode
memchr
tolower
abort
bsearch
realloc
memmove
qsort
_memccpy
_strdup
_stricmp
__p__fmode
__set_app_type
_controlfp
fopen
_getch

msvcp60

??0logic_error@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0out_of_range@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
??0out_of_range@std@@QAE@ABV01@@Z
??1out_of_range@std@@UAE@XZ

advapi32

RegQueryValueExA
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
SetServiceStatus
StartServiceA
OpenServiceA
ControlService
DeleteService
OpenSCManagerA
CreateServiceA
CloseServiceHandle
ChangeServiceConfig2A
RegDeleteValueA
RegCreateKeyExA
GetUserNameA
RegOpenKeyExA
RegSetValueExA
RegCloseKey

kernel32

GetCurrentProcess
GetCurrentThread
DuplicateHandle
InterlockedIncrement
GetThreadPriority
EnterCriticalSection
LeaveCriticalSection
ResumeThread
WaitForSingleObject
InterlockedDecrement
OpenProcess
TerminateProcess
MultiByteToWideChar
GetCurrentThreadId
GetTempPathA
CreateFileA
WriteFile
DeleteFileA
GetSystemDirectoryA
GetModuleFileNameA
CloseHandle
FreeLibrary
GetModuleHandleA
FreeConsole
AllocConsole
GetStdHandle
GlobalMemoryStatus
GetVersionExA
GetComputerNameA
ExpandEnvironmentStringsA
CreateProcessA
LoadLibraryA
GetProcAddress
Sleep
GetTickCount
CreateEventA
InitializeCriticalSection
DeleteCriticalSection
TlsSetValue
SetThreadPriority
GetCurrentProcessId
CopyFileA
CreateSemaphoreA
ReleaseSemaphore
TlsAlloc
TlsFree
SetLastError
TlsGetValue
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
ReadFile
TransactNamedPipe
WideCharToMultiByte
GetStartupInfoA
QueryPerformanceCounter
FlushConsoleInputBuffer
GetLastError

user32

ExitWindowsEx
wsprintfA

shell32

ShellExecuteA

ws2_32

WSASetLastError
shutdown
bind
listen
getservbyname
getpeername
WSAGetLastError
ioctlsocket
select
__WSAFDIsSet
WSAIoctl
WSACleanup
gethostbyaddr
gethostbyname
inet_ntoa
recv
WSAStartup
send
closesocket
socket
htons
connect
getsockname
inet_addr
WSASocketA
setsockopt
htonl
sendto
accept
gethostname

netapi32

NetUserEnum
NetShareEnum
NetApiBufferFree
NetUseDel
NetUseAdd
NetRemoteTOD
NetValidateName
NetScheduleJobAdd

mpr

WNetAddConnection2W
WNetAddConnection2A
WNetCancelConnection2A
WNetCancelConnection2W

psapi

EnumProcessModules
EnumProcesses
GetModuleBaseNameA

Sections

.text
Size: 376KB - Virtual size: 374KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 76KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

c85230c1c6d52bc01f0017e60b32dbf7

Headers

File Characteristics

Imports

msvcrt

msvcp60

advapi32

kernel32

user32

shell32

ws2_32

netapi32

mpr

psapi

Sections

.text Size: 376KB - Virtual size: 374KB

.rdata Size: 72KB - Virtual size: 71KB

.data Size: 76KB - Virtual size: 90KB

.text
Size: 376KB - Virtual size: 374KB

.rdata
Size: 72KB - Virtual size: 71KB

.data
Size: 76KB - Virtual size: 90KB